diff --git a/.github/scripts/macOS/prepare_free_sdks.sh b/.github/scripts/macOS/prepare_free_sdks.sh
new file mode 100755
index 000000000..02c7c2f56
--- /dev/null
+++ b/.github/scripts/macOS/prepare_free_sdks.sh
@@ -0,0 +1,6 @@
+#!/bin/sh -eux
+
+mkdir -p /var/tmp/sdks-free
+cd /var/tmp/sdks-free
+curl -S -LO https://www.ximea.com/downloads/recent/XIMEA_OSX_SP.dmg
+
diff --git a/.github/workflows/arm-build.yml b/.github/workflows/arm-build.yml
index a03c24c0a..fb8921eef 100644
--- a/.github/workflows/arm-build.yml
+++ b/.github/workflows/arm-build.yml
@@ -30,7 +30,7 @@ jobs:
       uses: actions/cache@v2
       with:
         path: 'chroot.tar'
-        key: cache-bootstrap-${{ matrix.arch }}-3
+        key: cache-bootstrap-${{ matrix.arch }}-${{ hashFiles('.github/scripts/Linux/arm/bootstrap.sh') }}
     - name: Debootstrap
       if: steps.cache-bootstrap.outputs.cache-hit != 'true'
       run: |
diff --git a/.github/workflows/ccpp.yml b/.github/workflows/ccpp.yml
index f15ce8db9..717713945 100644
--- a/.github/workflows/ccpp.yml
+++ b/.github/workflows/ccpp.yml
@@ -1,5 +1,7 @@
 name: C/C++ CI
 
+# TODO: cache keys should contain resource ETag (curl -LI <URL>) to see, if upstream has changed (see also get-date in https://github.com/actions/cache#creating-a-cache-key)
+
 on:
   push:
     branches:
@@ -81,7 +83,7 @@ jobs:
       uses: actions/cache@v2
       with:
         path: '/var/tmp/ffmpeg'
-        key: cache-ffmpeg-13
+        key: cache-ffmpeg-${{ runner.os }}-${{ hashFiles('.github/scripts/Linux/download_build_ffmpeg.sh') }}
     - name: Build FFmpeg
       if: steps.cache-ffmpeg.outputs.cache-hit != 'true'
       run: .github/scripts/Linux/download_build_ffmpeg.sh
@@ -138,7 +140,7 @@ jobs:
       uses: actions/cache@v2
       with:
         path: '/var/tmp/sdks'
-        key: cache-macos-sdks-3
+        key: cache-sdks-${{ runner.os }}-${{ hashFiles('.github/scripts/macOS/prepare.sh') }}
     - name: Download SDKs
       if: steps.cache-macos-sdk.outputs.cache-hit != 'true' && env.SDK_URL != null
       run: |
@@ -149,12 +151,10 @@ jobs:
       uses: actions/cache@v2
       with:
         path: '/var/tmp/sdks-free'
-        key: cache-macos-free-sdks-2
+        key: cache-free-sdks-${{ runner.os }}-${{ hashFiles('.github/scripts/macOS/prepare_free_sdks.sh') }}
     - name: Download Free SDKs
-      if: steps.cache-macos-free-sdk.outputs.cache-hit != 'true'
-      run: |
-        mkdir /var/tmp/sdks-free && cd /var/tmp/sdks-free
-        curl -S -LO https://www.ximea.com/downloads/recent/XIMEA_OSX_SP.dmg
+      if: steps.cache-macos-free-sdks.outputs.cache-hit != 'true'
+      run: $GITHUB_WORKSPACE/.github/scripts/macOS/prepare_free_sdks.sh
     - name: bootstrap
       run: |
         . .github/scripts/environment.sh
@@ -221,7 +221,7 @@ jobs:
       uses: actions/cache@v2
       with:
         path: 'C:\AJA'
-        key: cache-aja-3
+        key: cache-aja-${{ runner.os }}-${{ hashFiles('.github/scripts/Windows/build_aja.ps1') }}
     - name: Build AJA
       if: steps.cache-aja.outputs.cache-hit != 'true'
       run: .github/scripts/Windows/build_aja.ps1
@@ -229,8 +229,8 @@ jobs:
       id: cache-jack
       uses: actions/cache@v2
       with:
-        path: 'C:\Program Files (x86)\Jack'
-        key: cache-jack-3
+        path: 'C:\Program Files\JACK2'
+        key: cache-jack-${{ runner.os }}-${{ hashFiles('.github/scripts/Windows/install_jack.ps1') }}
     - name: Install JACK
       if: steps.cache-jack.outputs.cache-hit != 'true'
       run: .github/scripts/Windows/install_jack.ps1
@@ -239,7 +239,7 @@ jobs:
       uses: actions/cache@v2
       with:
         path: 'C:\live555'
-        key: cache-live555-2
+        key: cache-live555-${{ runner.os }}-${{ hashFiles('.github/scripts/Windows/build_live555.sh') }}
     - name: Build live555
       env:
         CC: gcc